CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-11-03 (5)

2026-11-03 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-11-03

5 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-102435 — 9.8 — The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This ma…
  • CVE-2026-86596 — 9.8 — The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags…
  • CVE-2026-120534 — 9.8 — The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of…
  • CVE-2026-105769 — 9.3 — kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrism…
  • CVE-2026-120518 — 9.1 — The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() …

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.